PT-2026-27460 · Unknown · Libvncserver

Y637F9Qq2X · Publicado 2026-03-24 · Atualizado 2026-05-09 · CVE-2026-32853

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions LibVNCServer versions prior to commit 009008e LibVNCServer version 0.9.15

Description The software contains a heap out-of-bounds read issue in the UltraZip encoding handler. A malicious VNC server can exploit this to cause information disclosure or application crash. The issue is due to improper bounds checking in the HandleUltraZipBPP() function. Attackers can manipulate subrectangle header counts to read beyond the allocated heap buffer.

Recommendations Update to a version after commit 009008e.

Exploit

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2026-32853

OESA-2026-2252

OESA-2026-2253

OESA-2026-2254

OESA-2026-2255

OPENSUSE-SU-2026:10433-1

OPENSUSE-SU-2026:20552-1

SUSE-SU-2026:1124-1

SUSE-SU-2026:1173-1

SUSE-SU-2026:1174-1

SUSE-SU-2026:21206-1

Produtos afetados

Libvncserver

Referências · 32

• 🔥 https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj · Exploit
• https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b3dbc931 · Correção
• https://osv.dev/vulnerability/OESA-2026-2254 · Aviso do Fabricante
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2252 · Nota
• https://bugzilla.suse.com/1260431 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32854 · Nota de Segurança
• https://osv.dev/vulnerability/SUSE-SU-2026:1173-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2026:21206-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-32853 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32853 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2026:1124-1 · Aviso do Fabricante
• https://vulncheck.com/advisories/libvncserver-ultrazip-encoding-heap-out-of-bounds-read · Aviso do Fabricante
• https://suse.com/support/update/announcement/2026/suse-su-20261173-1 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32853 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-32853 · Nota de Segurança